Homepage

org.springframework.boot:spring-boot-security@4.0.3

  • latest version

    4.0.5

  • latest non vulnerable version

    4.1.0-M4

  • first published

    9 months ago

  • latest version published

    1 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.springframework.boot:spring-boot-security package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Missing Authorization

    Affected versions of this package are vulnerable to Missing Authorization causing web security to be ineffective and allowing unauthorized access to all endpoints.

    Note:

    This is only exploitable if the following conditions are met:

    • the application is servlet-based;

    • the application has no Spring Security configuration of its own and relies on the default web security filter chain;

    • the application does not depend on spring-boot-health.

    How to fix Missing Authorization?

    Upgrade org.springframework.boot:spring-boot-security to version 4.0.6 or higher.

    [,4.0.6)
    Go back to all versions of this package